Security fixes are provided for the latest released version.
| Version | Supported |
|---|---|
| 1.2.x | ✅ |
| < 1.2 | ❌ |
Please do not open a public issue for security problems.
Report vulnerabilities privately through GitHub: Security → Report a vulnerability.
Include a description, the affected version, and a minimal program that reproduces the issue. We aim to acknowledge reports within a few business days and to release a fix or mitigation as soon as a valid issue is confirmed.
This package is a provider for TagBites.IO. The core security model - no sandbox, paths are the only limit, advisory permissions, content buffered through the system temporary directory - is described in the core security policy. What follows is specific to this provider.
The optional password is passed straight to SharpZipLib. The encryption strength is whatever the archive uses. A legacy ZipCrypto archive is weak regardless of the password.
Entry names come from the archive. This provider does not defend against a crafted archive with traversal names or a decompression bomb. Do not open an archive from an untrusted source into a directory that matters.